CVE-2024-36498

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-36498 Stored cross site scripting

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-36498

Image Access Scan2Net (Image Access Germany) is affected by a stored XSS vulnerability in the configuration menu’s Edit Disclaimer Text function due to missing input sanitization. The stored JavaScript payload executes in users’ browsers (including kiosk mode) when the ScanWizard loads. A fix was...

CVE-2023-36498

creationtimestamp| type| source ---|---|--- 2024-02-06 18:26:51+00:00| seen| https://t.me/ctinow/180200 2024-03-01 11:41:34+00:00| seen| https://t.me/ctinow/197526...

CVE-2023-36498

A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...

CVE-2023-36498

Summary: CVE-2023-36498 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos’ report details a post-authentication command injection vulnerability in the PPTP client exposed via the web interface (PPTP Client page). A specially crafted authenticated HTTP req...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1853 TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-36498 SUMMARY A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206...

CVE-2022-36498

creationtimestamp| type| source ---|---|--- 2022-08-25 18:23:34+00:00| seen| https://t.me/cibsecurity/48730...

CVE-2022-36498

Vulnerability overview: CVE-2022-36498 affects the H3C Magic NX18 Plus device, specifically NX18PV100R003, due to a stack overflow in the function Asp_SetTimingtimeWifiAndLed. The issue is reported as a stack overflow vulnerability in the device firmware; exploitation details indicate a local att...

CVE-2020-36498

creationtimestamp| type| source ---|---|--- 2021-10-23 00:39:49+00:00| seen| https://t.me/cibsecurity/31075...